how to use SSL ??

You need to check that your by law allowed to store credit cards on a database.  There are certain terms and conditions you need to abide by before you can do something like that

As someone who had his credit card lifted off of the server of a site selling CD's, I'm a big advocate of not keeping cc info at all.

I don't believe there's ever been an instance of someone lifting credit card info while it was in transit over an ssl/vpn connection. But there's beed a lot of instances where someone lifted a few thousand from a db.

FWIW, most of the larger outfits run their DB's behind a DMZ. An exposed web server passes a request along a specific port to an app server bedind a dmz. The app server passes it along to a db server within the dmz. If confidential personal info is involved - e.g. medical, ssn, or cc info, there's usually another dmz that has yet another db server behind it for that info. The two db servers talk to each other over non-standard ports, often using specific process id's that are set at boot time.